CISA Protection of Information Assets 4 — Questions and Answers
Question 1: An IS auditor reviews an organization's patch management policy and finds that critical security patches are applied within 72 hours on internet-facing servers but within 30 days on internal servers. What is the AUDITOR'S BEST assessment?
- The policy is adequate because internal servers are not directly exposed to the internet
- The tiered approach is acceptable only if internal servers are isolated from each other
- The 30-day window for internal servers may be excessive and should be risk-assessed (Correct answer)
- The policy should require uniform patching timelines across all systems
Correct answer: The 30-day window for internal servers may be excessive and should be risk-assessed
A blanket 30-day patch cycle for internal servers may be too long, especially for critical vulnerabilities, and the risk should be evaluated against the organization's threat profile.
Question 2: Which of the following BEST describes the concept of 'defense in depth' as applied to information security?
- Using the most advanced firewall technology available to block all threats
- Applying multiple overlapping security controls so that failure of one does not compromise the system (Correct answer)
- Ensuring that all security controls are managed by a central security team
- Prioritizing preventive controls over detective and corrective controls
Correct answer: Applying multiple overlapping security controls so that failure of one does not compromise the system
Defense in depth layers multiple security controls so that if one control fails or is bypassed, additional controls still protect the asset.
Question 3: An organization is implementing a new cloud storage solution for sensitive data. Which of the following should the IS auditor verify FIRST?
- Whether the cloud provider is publicly traded and financially stable
- Whether the organization retains control of encryption keys used to protect the data (Correct answer)
- Whether the cloud provider offers 99.99% uptime SLA
- Whether the cloud provider uses the same antivirus solution as the organization
Correct answer: Whether the organization retains control of encryption keys used to protect the data
Retaining control of encryption keys ensures that the organization can protect its data even if the cloud provider is compromised, subpoenaed, or goes out of business.
Question 4: An IS auditor evaluates an organization's identity governance program and finds that user access reviews are performed annually. What is the PRIMARY weakness of this approach?
- Annual reviews generate too much administrative overhead
- Excessive or unauthorized access can persist for up to 12 months before detection (Correct answer)
- Annual reviews are not required by most regulatory frameworks
- Users may forget their access rights have been reviewed
Correct answer: Excessive or unauthorized access can persist for up to 12 months before detection
Annual access reviews allow inappropriate access to go undetected for up to a year, significantly increasing the risk window for insider threats and privilege abuse.
Question 5: Which of the following is the MOST effective control to prevent SQL injection attacks against a web application?
- Implementing a web application firewall (WAF)
- Using parameterized queries and prepared statements in application code (Correct answer)
- Encrypting the database connection string
- Restricting database user privileges to read-only
Correct answer: Using parameterized queries and prepared statements in application code
Parameterized queries separate SQL code from user-supplied input at the code level, eliminating the root cause of SQL injection vulnerabilities.
Question 6: During a security audit, an IS auditor finds that developers have direct write access to the production database. What is the PRIMARY concern?
- Developers may slow down production performance with poorly optimized queries
- Direct production access bypasses change management controls and increases insider threat risk (Correct answer)
- Developers lack the expertise to manage production data safely
- The database may not be adequately backed up
Correct answer: Direct production access bypasses change management controls and increases insider threat risk
Direct developer access to production bypasses change management and audit trails, enabling unauthorized data modification and violating separation of duties.
Question 7: A company implements a data classification policy with four levels: Public, Internal, Confidential, and Restricted. Which control is MOST critical for Restricted data?
- Watermarking all printed copies of Restricted documents
- Restricting access on a need-to-know basis with strong authentication and audit logging (Correct answer)
- Requiring employees to sign a non-disclosure agreement before accessing Restricted data
- Storing all Restricted data on a dedicated file server
Correct answer: Restricting access on a need-to-know basis with strong authentication and audit logging
Need-to-know access combined with strong authentication and full audit logging provides the most comprehensive protection for the highest-sensitivity data classification.
CISA Protection of Information Assets 4
An IS auditor reviews an organization's patch management policy and finds that critical security patches are applied within 72 hours on internet-facing servers but within 30 days on internal servers.
What is the AUDITOR'S BEST assessment?